chore: audit

[PavelSBorisov]

Description:

• Adds PR formatting workflow enforcing conventional commits
• Adds CODEOWNERS
• Adds dependabot.yaml

Related issue(s):

Related to #39

Notes for reviewer:

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[PavelSBorisov]

@hiero-ledger/hiero-solo-action-maintainers, as part of the Release Engineering team audits, we are proposing a workflow that enforces conventional commits in the project.
This change brings benefits for commit history, maintainability and ease of automation in the future if the repo release process is to be implemented with semantic release tooling that produces a semantic version release based on the conventional commit types.
Please review and let us know if this standard makes sense for your project and if your team is willing to adopt it.

[hendrikebbers]

I do not see the need for CODEOWNERS in the repo. Dependabot makes sense

[hendrikebbers]

@PavelSBorisov can you give more information about "Release Engineering team audits" and what that means. Got that question from several other community members already

[PavelSBorisov]

@PavelSBorisov can you give more information about "Release Engineering team audits" and what that means. Got that question from several other community members already

@hendrikebbers the Release Engineering (GitHub Maintainers) team performs periodic audits on Hiero repositories, making sure that they are up to standards and secure.

If we need to exclude certain repositories from certain audit criteria (e.g. CODEOWNERS file) we would need to create a .github/audits/rules.md file documenting the exception in the repo and get approval from @rbarker-dev or @nathanklick

[rbarker-dev]

@PavelSBorisov can you give more information about "Release Engineering team audits" and what that means. Got that question from several other community members already

@hendrikebbers we are required to perform CI/CD security audits against all repos that we maintain. These audits are intended to be bi-annual and are performed by the @hiero-ledger/github-maintainers team.

The overall impact on projects should be minimal as we are ensuring compliance with the security configuration required of all projects in hiero-ledger.

---

What is the justification behind not having CODEOWNERS defined for this project? We can have an exception if needed, but generally even a basic CODEOWNERS file that says

*           @hiero-ledger/hiero-solo-action-maintainers

Is better than having no codeownership. This way it ensures that a maintainer is responsible for reviewing modifications to the project.

[rbarker-dev]

Suggested change

	/.github/workflows/ @hiero-ledger/github-maintainers
	/.github/workflows/ @hiero-ledger/github-maintainers @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

Suggested change

	/README.md @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers @hiero-ledger/hiero-solo-action-committers
	/README.md @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

Suggested change

	* @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers @hiero-ledger/hiero-solo-action-committers
	* @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

Suggested change

	/.github/ @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers @hiero-ledger/hiero-solo-action-committers
	/.github/ @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

Suggested change

	**/.gitignore @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers @hiero-ledger/hiero-solo-action-committers
	**/.gitignore @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

Suggested change

	**/.gitignore.* @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers @hiero-ledger/hiero-solo-action-committers
	**/.gitignore.* @hiero-ledger/github-maintainers @hiero-ledger/tsc @hiero-ledger/hiero-solo-action-maintainers

[rbarker-dev]

@PavelSBorisov there should be a self-hosted runner configured for solo action. Please ensure that all workflows are using the self-hosted runner configuration.

[nathanklick]

@hendrikebbers This is a requirement under the OpenSSF Best Practices: https://best.openssf.org/SCM-BestPractices/gitlab/project/repository_require_code_owner_reviews_policy.html

It is my understanding that LF/LFDT requires projects to adhere to the OpenSSF best practices. (see: https://lf-hyperledger.atlassian.net/wiki/spaces/TF/pages/21011885/Project+Lifecycle+Transitions+based+on+OpenSSF+Scorecard)